CVE-2017-16684 Missing Authentication check in SAP BI Promotion Management Application, SAP security note 2537152

SAP security note 2537152, "[CVE-2017-16684] Missing Authentication Check in SAP BI Promotion Management Application". Below are the symptom and SAP recommended solution.

Description

Symptom

SAP Business Intelligence (BI) Promotion Management Application does not perform any authentication checks for functionalities that require user identity.

Some well-known impacts of Missing Authentication check are:

• Read, modify, or delete sensitive information
• Access administrative or other privileged functionalities

Solution

Authentication checks are implemented in JSP files and redirect to the login page if the session is not valid.

This issue is or will be fixed in the patches listed in the Support Package Patches section below.

For the Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.

CVSS

Score 7.3 / 10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• 2144559 – BI 4.x Maintenance Strategy & Schedule